Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2024, 01:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7c7df757953bd6ee8d38ffb390111c97f5b5ed685bdbfa082773a37ed2f2b453.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
7c7df757953bd6ee8d38ffb390111c97f5b5ed685bdbfa082773a37ed2f2b453.exe
-
Size
455KB
-
MD5
6b13ece23985bc38347e0bb7993024dd
-
SHA1
c0d50b1d5f9b3f988ee93932855eacdde942692b
-
SHA256
7c7df757953bd6ee8d38ffb390111c97f5b5ed685bdbfa082773a37ed2f2b453
-
SHA512
8855a75c2ec200aa68212ef6ce1d56081f9361249971cc128c930132a641df30b71fd7b1fe048f5d6e0fc939b334159f749f7c39ef0f21d4e3fe1e86b8443ed8
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe/:q7Tc2NYHUrAwfMp3CD/
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1476-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2512-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/960-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2544-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4424-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2144-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/244-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2932-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4312-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3956-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4520-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4480-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1944-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2228-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3440-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2504-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4904-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1412-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1044-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3400-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2736-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1128-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2488-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2400-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4548-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4356-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4448-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4304-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3324-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2780-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4332-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3908-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2896-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3992-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2500-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2872-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4148-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4356-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2904-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4268-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3276-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4124-497-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3952-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3372-520-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-524-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2348-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1004-632-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4672-642-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3924-662-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-741-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-772-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5060-875-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4504-891-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2512 bnnhbb.exe 960 lrrrrrl.exe 2544 xrrrlxx.exe 4572 flflxxf.exe 4424 7jpjj.exe 2144 bbbtnn.exe 244 dpjjp.exe 3992 nhnhhh.exe 2932 ffllrrl.exe 4312 tbtttt.exe 5032 llllllf.exe 3956 tbbttb.exe 2516 dvvpv.exe 5004 xxxxxxx.exe 4520 lxxxxxx.exe 220 7jjjj.exe 4480 ffxflfl.exe 1944 tbhbtt.exe 2228 xffflrx.exe 4984 5ppvv.exe 3440 7tnhbh.exe 3144 jpppj.exe 2504 vdjdj.exe 1644 tnhbhh.exe 4364 jjpjj.exe 1140 nhnhbh.exe 3824 nnnbth.exe 4904 bbbbhh.exe 4816 dvjjv.exe 1412 lrfffxf.exe 1044 rrrrrrl.exe 3400 jvvpp.exe 2736 rrffrxr.exe 1128 tnbbbh.exe 5080 dvvpd.exe 2488 fxlfxxr.exe 2200 bttnnt.exe 3884 xrxrrrr.exe 2400 hnnnnn.exe 3768 hnnnhn.exe 3152 vdvvp.exe 4548 fllfxxl.exe 4356 bbttnt.exe 4448 9pjjd.exe 2376 lfrlflf.exe 4304 1htthb.exe 4428 hhhhhh.exe 3324 jpjdd.exe 2780 rffxxxx.exe 1396 rlxrllf.exe 3352 bbnnhh.exe 4332 jjpjj.exe 416 xlrlrll.exe 224 1lfrllf.exe 5060 bbnbhn.exe 2088 dpvpv.exe 2792 lfrrrlf.exe 3908 9llfffx.exe 3252 nthbtt.exe 3540 pdddj.exe 4928 lrxfllr.exe 1040 bbttnn.exe 2896 dvvpp.exe 916 dvpjd.exe -
resource yara_rule behavioral2/memory/1476-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2512-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2544-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/960-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2544-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4424-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2144-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/244-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2932-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4312-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3956-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4520-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1944-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2228-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3440-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2504-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4904-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1412-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1044-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3400-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2736-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1128-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2488-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2400-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4548-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4356-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4448-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4304-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3324-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2780-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4332-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3908-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2896-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3992-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2372-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2500-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2872-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4148-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3400-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3164-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4356-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2904-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4268-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3276-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4124-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3952-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3372-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2348-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1004-632-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4672-642-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3924-662-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3968-741-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1476 wrote to memory of 2512 1476 7c7df757953bd6ee8d38ffb390111c97f5b5ed685bdbfa082773a37ed2f2b453.exe 83 PID 1476 wrote to memory of 2512 1476 7c7df757953bd6ee8d38ffb390111c97f5b5ed685bdbfa082773a37ed2f2b453.exe 83 PID 1476 wrote to memory of 2512 1476 7c7df757953bd6ee8d38ffb390111c97f5b5ed685bdbfa082773a37ed2f2b453.exe 83 PID 2512 wrote to memory of 960 2512 bnnhbb.exe 84 PID 2512 wrote to memory of 960 2512 bnnhbb.exe 84 PID 2512 wrote to memory of 960 2512 bnnhbb.exe 84 PID 960 wrote to memory of 2544 960 lrrrrrl.exe 85 PID 960 wrote to memory of 2544 960 lrrrrrl.exe 85 PID 960 wrote to memory of 2544 960 lrrrrrl.exe 85 PID 2544 wrote to memory of 4572 2544 xrrrlxx.exe 86 PID 2544 wrote to memory of 4572 2544 xrrrlxx.exe 86 PID 2544 wrote to memory of 4572 2544 xrrrlxx.exe 86 PID 4572 wrote to memory of 4424 4572 flflxxf.exe 87 PID 4572 wrote to memory of 4424 4572 flflxxf.exe 87 PID 4572 wrote to memory of 4424 4572 flflxxf.exe 87 PID 4424 wrote to memory of 2144 4424 7jpjj.exe 88 PID 4424 wrote to memory of 2144 4424 7jpjj.exe 88 PID 4424 wrote to memory of 2144 4424 7jpjj.exe 88 PID 2144 wrote to memory of 244 2144 bbbtnn.exe 89 PID 2144 wrote to memory of 244 2144 bbbtnn.exe 89 PID 2144 wrote to memory of 244 2144 bbbtnn.exe 89 PID 244 wrote to memory of 3992 244 dpjjp.exe 90 PID 244 wrote to memory of 3992 244 dpjjp.exe 90 PID 244 wrote to memory of 3992 244 dpjjp.exe 90 PID 3992 wrote to memory of 2932 3992 nhnhhh.exe 91 PID 3992 wrote to memory of 2932 3992 nhnhhh.exe 91 PID 3992 wrote to memory of 2932 3992 nhnhhh.exe 91 PID 2932 wrote to memory of 4312 2932 ffllrrl.exe 92 PID 2932 wrote to memory of 4312 2932 ffllrrl.exe 92 PID 2932 wrote to memory of 4312 2932 ffllrrl.exe 92 PID 4312 wrote to memory of 5032 4312 tbtttt.exe 93 PID 4312 wrote to memory of 5032 4312 tbtttt.exe 93 PID 4312 wrote to memory of 5032 4312 tbtttt.exe 93 PID 5032 wrote to memory of 3956 5032 llllllf.exe 94 PID 5032 wrote to memory of 3956 5032 llllllf.exe 94 PID 5032 wrote to memory of 3956 5032 llllllf.exe 94 PID 3956 wrote to memory of 2516 3956 tbbttb.exe 95 PID 3956 wrote to memory of 2516 3956 tbbttb.exe 95 PID 3956 wrote to memory of 2516 3956 tbbttb.exe 95 PID 2516 wrote to memory of 5004 2516 dvvpv.exe 96 PID 2516 wrote to memory of 5004 2516 dvvpv.exe 96 PID 2516 wrote to memory of 5004 2516 dvvpv.exe 96 PID 5004 wrote to memory of 4520 5004 xxxxxxx.exe 97 PID 5004 wrote to memory of 4520 5004 xxxxxxx.exe 97 PID 5004 wrote to memory of 4520 5004 xxxxxxx.exe 97 PID 4520 wrote to memory of 220 4520 lxxxxxx.exe 98 PID 4520 wrote to memory of 220 4520 lxxxxxx.exe 98 PID 4520 wrote to memory of 220 4520 lxxxxxx.exe 98 PID 220 wrote to memory of 4480 220 7jjjj.exe 99 PID 220 wrote to memory of 4480 220 7jjjj.exe 99 PID 220 wrote to memory of 4480 220 7jjjj.exe 99 PID 4480 wrote to memory of 1944 4480 ffxflfl.exe 100 PID 4480 wrote to memory of 1944 4480 ffxflfl.exe 100 PID 4480 wrote to memory of 1944 4480 ffxflfl.exe 100 PID 1944 wrote to memory of 2228 1944 tbhbtt.exe 101 PID 1944 wrote to memory of 2228 1944 tbhbtt.exe 101 PID 1944 wrote to memory of 2228 1944 tbhbtt.exe 101 PID 2228 wrote to memory of 4984 2228 xffflrx.exe 102 PID 2228 wrote to memory of 4984 2228 xffflrx.exe 102 PID 2228 wrote to memory of 4984 2228 xffflrx.exe 102 PID 4984 wrote to memory of 3440 4984 5ppvv.exe 103 PID 4984 wrote to memory of 3440 4984 5ppvv.exe 103 PID 4984 wrote to memory of 3440 4984 5ppvv.exe 103 PID 3440 wrote to memory of 3144 3440 7tnhbh.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c7df757953bd6ee8d38ffb390111c97f5b5ed685bdbfa082773a37ed2f2b453.exe"C:\Users\Admin\AppData\Local\Temp\7c7df757953bd6ee8d38ffb390111c97f5b5ed685bdbfa082773a37ed2f2b453.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\bnnhbb.exec:\bnnhbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\lrrrrrl.exec:\lrrrrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
\??\c:\xrrrlxx.exec:\xrrrlxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\flflxxf.exec:\flflxxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\7jpjj.exec:\7jpjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\bbbtnn.exec:\bbbtnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\dpjjp.exec:\dpjjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
\??\c:\nhnhhh.exec:\nhnhhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\ffllrrl.exec:\ffllrrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\tbtttt.exec:\tbtttt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\llllllf.exec:\llllllf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\tbbttb.exec:\tbbttb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\dvvpv.exec:\dvvpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\xxxxxxx.exec:\xxxxxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\lxxxxxx.exec:\lxxxxxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\7jjjj.exec:\7jjjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\ffxflfl.exec:\ffxflfl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\tbhbtt.exec:\tbhbtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\xffflrx.exec:\xffflrx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\5ppvv.exec:\5ppvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\7tnhbh.exec:\7tnhbh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
\??\c:\jpppj.exec:\jpppj.exe23⤵
- Executes dropped EXE
PID:3144 -
\??\c:\vdjdj.exec:\vdjdj.exe24⤵
- Executes dropped EXE
PID:2504 -
\??\c:\tnhbhh.exec:\tnhbhh.exe25⤵
- Executes dropped EXE
PID:1644 -
\??\c:\jjpjj.exec:\jjpjj.exe26⤵
- Executes dropped EXE
PID:4364 -
\??\c:\nhnhbh.exec:\nhnhbh.exe27⤵
- Executes dropped EXE
PID:1140 -
\??\c:\nnnbth.exec:\nnnbth.exe28⤵
- Executes dropped EXE
PID:3824 -
\??\c:\bbbbhh.exec:\bbbbhh.exe29⤵
- Executes dropped EXE
PID:4904 -
\??\c:\dvjjv.exec:\dvjjv.exe30⤵
- Executes dropped EXE
PID:4816 -
\??\c:\lrfffxf.exec:\lrfffxf.exe31⤵
- Executes dropped EXE
PID:1412 -
\??\c:\rrrrrrl.exec:\rrrrrrl.exe32⤵
- Executes dropped EXE
PID:1044 -
\??\c:\jvvpp.exec:\jvvpp.exe33⤵
- Executes dropped EXE
PID:3400 -
\??\c:\rrffrxr.exec:\rrffrxr.exe34⤵
- Executes dropped EXE
PID:2736 -
\??\c:\tnbbbh.exec:\tnbbbh.exe35⤵
- Executes dropped EXE
PID:1128 -
\??\c:\dvvpd.exec:\dvvpd.exe36⤵
- Executes dropped EXE
PID:5080 -
\??\c:\fxlfxxr.exec:\fxlfxxr.exe37⤵
- Executes dropped EXE
PID:2488 -
\??\c:\bttnnt.exec:\bttnnt.exe38⤵
- Executes dropped EXE
PID:2200 -
\??\c:\xrxrrrr.exec:\xrxrrrr.exe39⤵
- Executes dropped EXE
PID:3884 -
\??\c:\hnnnnn.exec:\hnnnnn.exe40⤵
- Executes dropped EXE
PID:2400 -
\??\c:\hnnnhn.exec:\hnnnhn.exe41⤵
- Executes dropped EXE
PID:3768 -
\??\c:\vdvvp.exec:\vdvvp.exe42⤵
- Executes dropped EXE
PID:3152 -
\??\c:\fllfxxl.exec:\fllfxxl.exe43⤵
- Executes dropped EXE
PID:4548 -
\??\c:\bbttnt.exec:\bbttnt.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4356 -
\??\c:\9pjjd.exec:\9pjjd.exe45⤵
- Executes dropped EXE
PID:4448 -
\??\c:\lfrlflf.exec:\lfrlflf.exe46⤵
- Executes dropped EXE
PID:2376 -
\??\c:\1htthb.exec:\1htthb.exe47⤵
- Executes dropped EXE
PID:4304 -
\??\c:\hhhhhh.exec:\hhhhhh.exe48⤵
- Executes dropped EXE
PID:4428 -
\??\c:\jpjdd.exec:\jpjdd.exe49⤵
- Executes dropped EXE
PID:3324 -
\??\c:\rffxxxx.exec:\rffxxxx.exe50⤵
- Executes dropped EXE
PID:2780 -
\??\c:\rlxrllf.exec:\rlxrllf.exe51⤵
- Executes dropped EXE
PID:1396 -
\??\c:\bbnnhh.exec:\bbnnhh.exe52⤵
- Executes dropped EXE
PID:3352 -
\??\c:\jjpjj.exec:\jjpjj.exe53⤵
- Executes dropped EXE
PID:4332 -
\??\c:\xlrlrll.exec:\xlrlrll.exe54⤵
- Executes dropped EXE
PID:416 -
\??\c:\1lfrllf.exec:\1lfrllf.exe55⤵
- Executes dropped EXE
PID:224 -
\??\c:\bbnbhn.exec:\bbnbhn.exe56⤵
- Executes dropped EXE
PID:5060 -
\??\c:\dpvpv.exec:\dpvpv.exe57⤵
- Executes dropped EXE
PID:2088 -
\??\c:\lfrrrlf.exec:\lfrrrlf.exe58⤵
- Executes dropped EXE
PID:2792 -
\??\c:\9llfffx.exec:\9llfffx.exe59⤵
- Executes dropped EXE
PID:3908 -
\??\c:\nthbtt.exec:\nthbtt.exe60⤵
- Executes dropped EXE
PID:3252 -
\??\c:\pdddj.exec:\pdddj.exe61⤵
- Executes dropped EXE
PID:3540 -
\??\c:\lrxfllr.exec:\lrxfllr.exe62⤵
- Executes dropped EXE
PID:4928 -
\??\c:\bbttnn.exec:\bbttnn.exe63⤵
- Executes dropped EXE
PID:1040 -
\??\c:\dvvpp.exec:\dvvpp.exe64⤵
- Executes dropped EXE
PID:2896 -
\??\c:\dvpjd.exec:\dvpjd.exe65⤵
- Executes dropped EXE
PID:916 -
\??\c:\fxxrllf.exec:\fxxrllf.exe66⤵PID:3992
-
\??\c:\bttnnh.exec:\bttnnh.exe67⤵PID:944
-
\??\c:\7vdvd.exec:\7vdvd.exe68⤵PID:3092
-
\??\c:\lllxxxr.exec:\lllxxxr.exe69⤵PID:2372
-
\??\c:\thbhbn.exec:\thbhbn.exe70⤵PID:5032
-
\??\c:\jjjjd.exec:\jjjjd.exe71⤵PID:4140
-
\??\c:\1rfffll.exec:\1rfffll.exe72⤵PID:1012
-
\??\c:\hbnnnt.exec:\hbnnnt.exe73⤵PID:2616
-
\??\c:\9jdvv.exec:\9jdvv.exe74⤵PID:4784
-
\??\c:\lrflxrx.exec:\lrflxrx.exe75⤵PID:1340
-
\??\c:\hhnbhn.exec:\hhnbhn.exe76⤵
- System Location Discovery: System Language Discovery
PID:536 -
\??\c:\jdvpd.exec:\jdvpd.exe77⤵PID:2500
-
\??\c:\lrfflll.exec:\lrfflll.exe78⤵PID:2732
-
\??\c:\thttnt.exec:\thttnt.exe79⤵PID:2872
-
\??\c:\bbbbbh.exec:\bbbbbh.exe80⤵PID:4888
-
\??\c:\vpjdd.exec:\vpjdd.exe81⤵PID:5088
-
\??\c:\lxrlxrl.exec:\lxrlxrl.exe82⤵PID:4148
-
\??\c:\nbbtnh.exec:\nbbtnh.exe83⤵PID:2944
-
\??\c:\pjjjd.exec:\pjjjd.exe84⤵PID:456
-
\??\c:\ffllfff.exec:\ffllfff.exe85⤵PID:2052
-
\??\c:\5bbtnn.exec:\5bbtnn.exe86⤵PID:5096
-
\??\c:\nntnbb.exec:\nntnbb.exe87⤵PID:1616
-
\??\c:\lfrxrrr.exec:\lfrxrrr.exe88⤵PID:3168
-
\??\c:\xrlffff.exec:\xrlffff.exe89⤵PID:3824
-
\??\c:\nbhhhh.exec:\nbhhhh.exe90⤵PID:4368
-
\??\c:\pvddd.exec:\pvddd.exe91⤵PID:4816
-
\??\c:\vvpjd.exec:\vvpjd.exe92⤵PID:2892
-
\??\c:\rxxlfrl.exec:\rxxlfrl.exe93⤵PID:2668
-
\??\c:\tbhhbh.exec:\tbhhbh.exe94⤵PID:4776
-
\??\c:\nnnbtb.exec:\nnnbtb.exe95⤵PID:3400
-
\??\c:\jjvvv.exec:\jjvvv.exe96⤵PID:1016
-
\??\c:\lflffxr.exec:\lflffxr.exe97⤵PID:3008
-
\??\c:\3hnnnn.exec:\3hnnnn.exe98⤵PID:4076
-
\??\c:\thnbbt.exec:\thnbbt.exe99⤵PID:2292
-
\??\c:\7vvpj.exec:\7vvpj.exe100⤵PID:1772
-
\??\c:\xxfffff.exec:\xxfffff.exe101⤵PID:4300
-
\??\c:\7fffxfx.exec:\7fffxfx.exe102⤵PID:2612
-
\??\c:\7nhbbb.exec:\7nhbbb.exe103⤵PID:4420
-
\??\c:\pvjjv.exec:\pvjjv.exe104⤵PID:3164
-
\??\c:\xxllllf.exec:\xxllllf.exe105⤵PID:1936
-
\??\c:\bhntbh.exec:\bhntbh.exe106⤵PID:2192
-
\??\c:\ppjdv.exec:\ppjdv.exe107⤵PID:4356
-
\??\c:\lffxrfx.exec:\lffxrfx.exe108⤵PID:1620
-
\??\c:\rlxrlxx.exec:\rlxrlxx.exe109⤵PID:4384
-
\??\c:\htnnnn.exec:\htnnnn.exe110⤵PID:400
-
\??\c:\dddpj.exec:\dddpj.exe111⤵PID:2904
-
\??\c:\1xxrlff.exec:\1xxrlff.exe112⤵PID:3324
-
\??\c:\hhhnhb.exec:\hhhnhb.exe113⤵PID:4896
-
\??\c:\vpddd.exec:\vpddd.exe114⤵PID:4344
-
\??\c:\lxrlfxl.exec:\lxrlfxl.exe115⤵PID:4348
-
\??\c:\tntnhh.exec:\tntnhh.exe116⤵PID:3292
-
\??\c:\vpjdp.exec:\vpjdp.exe117⤵PID:4268
-
\??\c:\5vpjd.exec:\5vpjd.exe118⤵PID:4752
-
\??\c:\xrrlllx.exec:\xrrlllx.exe119⤵PID:4516
-
\??\c:\hbbtnn.exec:\hbbtnn.exe120⤵PID:5028
-
\??\c:\7vvvj.exec:\7vvvj.exe121⤵PID:3276
-
\??\c:\flrrllr.exec:\flrrllr.exe122⤵PID:756
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-